在 MySQL 中使用网络命名空间支持之前，必须满足以下主机系统前提条件：Prior to using network namespace support in MySQL, these host system prerequisites must be satisfied:

以下示例中的指令设置了名为 red 和 blue 的网络命名空间。您选择的名称可能不同，主机系统上的网络地址和接口也可能不同。The instructions in the following example set up network namespaces named red and blue. The names you choose may differ, as may the network addresses and interfaces on your host system.

以 root 操作系统用户身份执行此处显示的命令，或者在每个命令前加上 sudo。例如，如果您不是 root，要执行 ip 或 setcap 命令，请使用 sudo ip 或 sudo setcap。Invoke the commands shown here either as the root operating system user or by prefixing each command with sudo. For example, to invoke the ip or setcap command if you are not root, use sudo ip or sudo setcap.

要配置网络命名空间，请使用 ip 命令。对于某些操作，ip 命令必须在特定的命名空间内执行（该命名空间必须已存在）。在这种情况下，命令的开头如下：To configure network namespaces, use the ip command. For some operations, the ip command must execute within a particular namespace (which must already exist). In such cases, begin the command like this:

ip netns exec namespace_name

例如，下列命令在 red 命名空间内执行以启动环回接口：For example, this command executes within the red namespace to bring up the loopback interface:

ip netns exec red ip link set lo up

要添加名为 red 和 blue 的命名空间，每个命名空间都有自己的虚拟以太网设备，用作命名空间之间的连接，以及自己的环回接口：To add namespaces named red and blue, each with its own virtual Ethernet device used as a link between namespaces and its own loopback interface:

ip netns add red
ip link add veth-red type veth peer name vpeer-red
ip link set vpeer-red netns red
ip addr add 192.0.2.1/24 dev veth-red
ip link set veth-red up
ip netns exec red ip addr add 192.0.2.2/24 dev vpeer-red
ip netns exec red ip link set vpeer-red up
ip netns exec red ip link set lo up

ip netns add blue
ip link add veth-blue type veth peer name vpeer-blue
ip link set vpeer-blue netns blue
ip addr add 198.51.100.1/24 dev veth-blue
ip link set veth-blue up
ip netns exec blue ip addr add 198.51.100.2/24 dev vpeer-blue
ip netns exec blue ip link set vpeer-blue up
ip netns exec blue ip link set lo up

# if you want to enable inter-subnet routing...
sysctl net.ipv4.ip_forward=1
ip netns exec red ip route add default via 192.0.2.1
ip netns exec blue ip route add default via 198.51.100.1

命名空间之间的链接示意图如下：A diagram of the links between namespaces looks like this:

red              global           blue

192.0.2.2   <=>  192.0.2.1
(vpeer-red)      (veth-red)

                 198.51.100.1 <=> 198.51.100.2
                 (veth-blue)      (vpeer-blue)

要检查哪些命名空间和链接存在：To check which namespaces and links exist:

ip netns list
ip link list

要查看全局和命名命名空间的路由表：To see the routing tables for the global and named namespaces:

ip route show
ip netns exec red ip route show
ip netns exec blue ip route show

要移除 red 和 blue 链接和命名空间：To remove the red and blue links and namespaces:

ip link del veth-red
ip link del veth-blue

ip netns del red
ip netns del blue

sysctl net.ipv4.ip_forward=0

为了让包含网络命名空间支持的 MySQL 二进制文件能够实际使用命名空间，必须授予它们 CAP_SYS_ADMIN 权限。以下 setcap 命令假设您已切换到包含 MySQL 二进制文件的目录（根据系统情况调整路径名）：So that the MySQL binaries that include network namespace support can actually use namespaces, you must grant them the CAP_SYS_ADMIN capability. The following setcap commands assume that you have changed location to the directory containing your MySQL binaries (adjust the pathname for your system as necessary):

cd /usr/local/mysql/bin

要授予适当的二进制文件 CAP_SYS_ADMIN 权限：To grant CAP_SYS_ADMIN capability to the appropriate binaries:

setcap cap_sys_admin+ep ./mysqld
setcap cap_sys_admin+ep ./mysql
setcap cap_sys_admin+ep ./mysqlxtest

检查 CAP_SYS_ADMIN 权限：To check CAP_SYS_ADMIN capability:

$> getcap ./mysqld ./mysql ./mysqlxtest
./mysqld = cap_sys_admin+ep
./mysql = cap_sys_admin+ep
./mysqlxtest = cap_sys_admin+ep

移除 CAP_SYS_ADMIN 权限：To remove CAP_SYS_ADMIN capability:

setcap -r ./mysqld
setcap -r ./mysql
setcap -r ./mysqlxtest

[ERROR] [MY-013408] [Server] setns() failed with error 'Operation not permitted'

ERROR: Network namespace error: Operation not permitted

假设前述主机系统的前提条件已经满足，MySQL 允许配置连接的监听（入站）端的服务器端命名空间以及连接的出站端的客户端命名空间。Assuming that the preceding host system prerequisites have been satisfied, MySQL enables configuring the server-side namespace for the listening (inbound) side of connections and the client-side namespace for the outbound side of connections.

在服务器端，bind_address、admin_address 和 mysqlx_bind_address 系统变量具有扩展语法，用于指定用于监听传入连接的给定 IP 地址或主机名的网络命名空间。要为地址指定命名空间，请添加斜杠和命名空间名称。例如，服务器 my.cnf 文件可能包含以下几行：On the server side, the bind_address, admin_address, and mysqlx_bind_address system variables have extended syntax for specifying the network namespace to use for a given IP address or host name on which to listen for incoming connections. To specify a namespace for an address, add a slash and the namespace name. For example, a server my.cnf file might contain these lines:

[mysqld]
bind_address = 127.0.1.1,192.0.2.2/red,198.51.100.2/blue
admin_address = 102.0.2.2/red
mysqlx_bind_address = 102.0.2.2/red

这些规则适用：These rules apply:

如果在服务器启动期间尝试使用命名空间时发生错误，服务器将无法启动。如果在 X 插件初始化期间发生错误，导致无法绑定到任何地址，该插件将初始化失败，并且服务器不会加载它。If an error occurs during server startup for attempts to use a namespace, the server does not start. If errors occur for X Plugin during plugin initialization such that it is unable to bind to any address, the plugin fails its initialization sequence and the server does not load it.

在客户端，可以在以下情况下指定网络命名空间：On the client side, a network namespace can be specified in these contexts:

以下示例设置了一个 MySQL 服务器，该服务器在全局、red 和 blue 命名空间中监听连接，并展示了如何配置从 red 和 blue 命名空间连接的帐户。假设 red 和 blue 命名空间已经按照 主机系统先决条件 中的示例创建。The following example sets up a MySQL server that listens for connections in the global, red, and blue namespaces, and shows how to configure accounts that connect from the red and blue namespaces. It is assumed that the red and blue namespaces have already been created as shown in Host System Prerequisites.

为了复制监控的目的，这些信息源有一列显示连接所适用的网络命名空间：For replication monitoring purposes, these information sources have a column that displays the applicable network namespace for connections: